EUVD-2026-28045Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
ORB bypass crosses the same-origin security boundary (S:C); impact is cross-origin confidentiality only, with no integrity or availability impact evident from the bypass mechanism.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in ORB in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Site isolation bypass in Google Chrome prior to 148.0.7778.96 allows a remote attacker to read cross-origin response data that Chrome's Opaque Response Blocking (ORB) mechanism should render inaccessible, by luring a user to a crafted HTML page. The flaw stems from an inappropriate implementation in the ORB subsystem (CWE-269), undermining one of Chrome's core cross-origin data leak defenses. No active exploitation is confirmed (SSVC: none; EPSS: 0.03%), and a vendor patch is available in the stable channel release 148.0.7778.96.
Technical ContextAI
Opaque Response Blocking (ORB) is a browser security feature that prevents renderer-process scripts from inspecting the body of cross-origin 'opaque' responses - fetch or XHR responses that succeed at the network layer but whose content the requesting origin is not permitted to read under the Same-Origin Policy. ORB acts as a complement to Site Isolation, which places cross-origin documents in separate OS processes. CWE-269 (Improper Privilege Management) identifies the root cause: the Chrome ORB subsystem fails to correctly enforce the privilege boundary that determines which response bodies may be exposed to the requesting origin's script context, allowing a crafted page to obtain data that should remain opaque. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Google Chrome desktop releases prior to 148.0.7778.96 across Windows, macOS, and Linux. Downstream Linux distributions including Red Hat and SUSE are tagged as redistributors who carry Chrome or Chromium packages affected by this issue.
RemediationAI
Update Google Chrome to version 148.0.7778.96 or later - this is the vendor-released patch per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Enterprise deployments should use Google Update, Chrome Browser Cloud Management, or distribution-provided package managers to push the update. Red Hat and SUSE users should monitor their vendor channels for patched Chromium packages and apply updates via dnf or zypper once available. No documented workarounds exist for this ORB implementation flaw short of upgrading; disabling JavaScript would prevent exploitation but carries severe usability trade-offs and is not a practical enterprise control. Given the UI:R attack vector, network-layer controls (proxy filtering, URL blocklists) can reduce exposure to attacker-controlled pages but cannot be relied upon as a substitute for patching.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today